PRIVACY POLICY

1. Who is responsible

reCRQL AB, Sankt Paulsgatan 22A, 118 48 Stockholm, Sweden, is responsible for personal data in reCRQL: the app where you sell, the shops where buyers shop, and this website. The shops carry our partners' names and looks, but we run them and handle the data. Questions about your data go to [email protected].

2. If you sell in the app

We process:

• your email address, which is your account (you sign in with a code we email you)
• the name, phone number and addresses you enter, so we can ship what you sell
• the photos and text in your listings
• your sales, payouts and any cases
• a push notification code from your phone, if you allow notifications

We do this to perform our agreement with you: publish what you sell, take payment, book shipping, pay you and handle cases.

Purchases from shops. If you ask us to, we fetch your earlier purchases from the shops on the platform using your email address, so you don't have to add the garments yourself. We only ask those shops, and only use what they answer to create listings for you. Some shops reward their members for selling. Then we tell the shop that you sold something.

Reviewing listings. Photos and text are reviewed before they are shown, partly by an AI service (Google Gemini) and partly by us, to stop things that don't belong in the shops. We do this because we have a legitimate interest in safe shops. No decision that seriously affects you is made automatically alone: you can replace a photo that is stopped, and we look at whatever the AI is unsure about ourselves.

3. If you buy in a shop

We process your email address, name, delivery address and phone number, what you buy and any cases. That is needed to complete the purchase, send the item and help you if something goes wrong. The seller never sees your address, because the shipping label is printed at the service point. Card details go straight to our payment provider. We never see them.

4. If you visit the website

If you write to us through the contact form, we keep what you write and your address so we can reply. Which cookies the website sets is in our cookie policy.

5. Who we share data with

Only those the service needs to work, and only what they need:

• Stripe takes payments and makes payouts to sellers.
• PostNord carries the parcels and gets the sender's and recipient's addresses.
• Amazon Web Services runs the platform and stores the data in Stockholm.
• Mailchimp Transactional (Mandrill) sends our emails.
• Expo sends push notifications to the app.
• Google (Gemini) helps us review photos and text.
• Sentry receives error reports, without names or contact details.
• Cloudflare and Google Firebase deliver the website.
• Fortnox is used for our bookkeeping.
• The shop where something sells learns what was sold, but not who bought or sold it.

We never sell personal data.

6. Transfers outside the EU/EEA

Some of the providers above are US companies and may process data in the United States. Where they do, we rely on the European Commission's standard contractual clauses, or on the recipient being certified under the EU–US Data Privacy Framework.

7. How long we keep data

• We keep your account and listings until you delete your account.
• We keep records of purchases and payouts for seven years, as Swedish bookkeeping law requires.
• We keep cases as long as the purchase they concern.

If you delete your account in the app, it closes at once and your listings come down. Your personal data is removed as soon as no purchase, case or money owed to you is still open. What bookkeeping requires stays, but no longer linked to you.

8. Your rights

You have the right to know what data we hold about you, to have mistakes corrected and to have data erased. You can also restrict or object to processing based on legitimate interest, and get the data you gave us in a format you can take elsewhere. Email [email protected] and we reply within a month. You can delete your account straight from the app, under Profile.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection, imy.se.

9. Security

The data is stored encrypted at Amazon Web Services in Stockholm. Only the people on our team who need it for their work can reach it, and what they do is logged. There are no passwords to leak, because you sign in with a one-time code.

10. Changes

If we change this policy in a way that matters to you, we tell you in the app or by email before the change applies.